[ruby-core:78288] Deserialization & const_missing

Hi,


I'm finding an issue with deserializing (Marshal, YAML) objects whose
classes are lazily loaded.


Here's a demo: (run with argument 'store' and then with argument 'load')


module C

  def self.const_missing(name)

    const_set name, Struct.new(:x, :y)

  end

end


case ARGV[0]

when 'store'

  lazy = C::Lazy.new(1, 2)

  open('test.marshal', 'w') { |f| Marshal.dump(lazy, f) }

when 'load'

  lazy = open('test.marshal') { |f| Marshal.load(f) }

  p lazy

else

  abort "need argument: load or store"

end



I saw this was discussed a few months ago in the Developers' Meeting. Here
are the notes:


  * [Feature #3511] rb_path_to_class should call custom const_defined?
methods (shyouhei)

    * akr: this is dangerous to implement.

    * ko1: is this backward compatible? akr: it seems.

    * Matz: It seems it hurts than it gains.


Could someone please summarize the dangers here?


What I would love is the ability to opt-in to allowing this behavior. I
understand there could be some danger if you autoload in multiple threads
at once, but in my use case (a rails app that serializes objects to a job
queue and processes them on other machines), we do not have this danger
because the processes involved are single-threaded.


Would you consider having an option that lets us turn on such behavior?


References:

 * https://bugs.ruby-lang.org/issues/3511

 * https://bugs.ruby-lang.org/issues/12731


Thanks!

Unsubscribe: <mailto:[e-mail]?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>